CVE-2026-76893
tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an mcp-session-id claims the shared transport state, causing later independent clients to receive Server already initialized and preventing them from establishing sessions until the process restarts. The first client's session remains functional. This issue is fixed in version 4.3.2.
| CWE | CWE-400 |
| Vendor | tsparticles |
| Product | tsparticles |
| Published | Nov 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for tsparticles tsparticles
Be the first to know when new unknown vulnerabilities affecting tsparticles tsparticles are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
tsparticles / tsparticles
< 4.3.2
@tsparticles / mcp-server
< 4.3.2